Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare expands its government warrant canaries

techcrunch.com

Post reply on HN
Print view View original

111–120 of 163 posts

Re: Cloudflare expands its government warrant canaries

#111

Post by dragonwriter »

balabaster wrote: post #98
dragonwriter wrote: post #96

Earlier quoted context omitted.

> Can you elaborate as to how a compelled untruthful (electronic) declaration for the purpose of continuing to obtain sales of your product is NOT (wire) fraud? I'm saying—and I said this expressly in the post you responded to—that that isn't the purpose, which is the strongest reason it isn't criminal fraud. Your initial purpose in the warrant canary was sales, sure, but the government wasn't involved in that and it…

Your compliance with that order is not for that purpose. HOWEVER, your statement which was originally to generate sales went from being truthful to being untruthful. So now that your warrant canary is false, you are making an untruthful statement supporting sales generation for your company, which is what makes it fraudulent; and in my mind at least, because you've been compelled to do so, that's conspiracy to commit…

> HOWEVER, your statement which was originally to generate sales went from being truthful to being untruthful.

You made a true statement with the purpose of generating sales, and later a false statement with a different purpose. The fact that the two statements have the same content doesn't make the intent of one transfer to the other, or the falsity of one transfer to the other.

The required mental state for a crime must connect to the required act, not just a generally similar act at a different time.

(Of course, the government compelling your action by force means it cannot be prosecuted as a crime of yours, because when the government induces a crime you would not otherwise have committed by threats, that's called “entrapment”.)

> and in my mind at least, because you've been compelled to do so, that's conspiracy to commit fraud.

No, aside from the fact that you don't have a false statement made with the required purpose to start with, the fact that you are compelled by the government doesn't make a conspiracy.

> I guess they could argue that you weren't compelled to continue operating. You could have shuttered your business. So in that sense, I suppose if they made that argument, the fraud would be on your head and they'd get off on that technicality.

No, they’d get off because their power to issue and enforce non-disclosure directives with NSLs, etc., is an express power granted in law.

Re: Cloudflare expands its government warrant canaries

#113

Post by eastdakota »

arkades wrote: post #82
oldgregg wrote: post #69

Could a company create a warrant canary for every user? Just a simple notice when you login to your account? If the premise of the canary is that they can force you to keep silent but can't compel you to speak, what would prevent a company from doing this?

That that degree of behavior would be completely unsympathetic to both jurists and jurors, pretty much guaranteeing it would get slapped down in court eventually, even if totally legit

That’d be my read too. You can definitely be “too clever.” Laws aren’t like computer code. They’re interpreted by humans. And, if you’re “too cute” and violate the spirit of the law, you can quickly find yourself on the wrong side.

Re: Cloudflare expands its government warrant canaries

#114

Post by matt4077 »

balabaster wrote: post #98
dragonwriter wrote: post #96

Earlier quoted context omitted.

> Can you elaborate as to how a compelled untruthful (electronic) declaration for the purpose of continuing to obtain sales of your product is NOT (wire) fraud? I'm saying—and I said this expressly in the post you responded to—that that isn't the purpose, which is the strongest reason it isn't criminal fraud. Your initial purpose in the warrant canary was sales, sure, but the government wasn't involved in that and it…

Your compliance with that order is not for that purpose. HOWEVER, your statement which was originally to generate sales went from being truthful to being untruthful. So now that your warrant canary is false, you are making an untruthful statement supporting sales generation for your company, which is what makes it fraudulent; and in my mind at least, because you've been compelled to do so, that's conspiracy to commit…

You should really try to learn from the well-reasoned explanation of why your initial hunch was wrong, instead of continuing to try to argue the point with increasing levels of obviously wrong grammatical and legalistic hairsplitting.

Law is a system that, to a certain degree, depends on reasonable people employing commonly accepted rules of logic and teleology. It is not a programming language that can be “tricked” by superficial attempts at “being clever”.

Re: Cloudflare expands its government warrant canaries

#115

Post by Arnt »

throwaway88643 wrote: post #89
Arnt wrote: post #29

Earlier quoted context omitted.

Well, of course anyone can point a gun at your newborn baby. But a government agency have to comply with the law, and the law makes certain requirements on officers of companies. The details are complicated, but simplifying, if a company is publicly traded and someone whose title starts with V or C says something in public, then it has to be true. Three-letter government agencies can't both comply with the law and at…

Didn’t Snowden reveal that government agencies routinely break the law?

Indeed he did. He didn't reveal that they routinely compel random CxOs to do so, though.

Re: Cloudflare expands its government warrant canaries

#116

Post by matt4077 »

skrebbel wrote: post #22
rsync wrote: post #3

The rsync.net warrant canary is 13 years old this April: https://www.rsync.net/resources/notices/canary.txt "The first commercial use of a warrant canary was by the US cloud storage provider rsync.net, which began publishing its canary in 2006. In addition to a digital signature, it provides a recent news headline as proof that the warrant canary was recently posted as well as mirroring the posting internationally."[…

I've never completely understood this. What prevents you from lying about this? I mean, let's imagine a hypothetical 100% evil three letter agency. They'd just threaten you and your family members' lives and you'd keep updating the canary right? How can we know you keep updating it out of your own free will?

The idea (and reality) is that government entities in democracy tend to follow the law.

Trying to invent schemes to defend against the breakdown of the rule of law is sort of like buying insurance against the world ending.

Re: Cloudflare expands its government warrant canaries

#117

Post by grecy »

rsync wrote: post #78
jjeaff wrote: post #57

Earlier quoted context omitted.

Except all those are examples of acting in bad faith. The question at hand here is whether the government can compel you to keep the canary in place after a search/siezure. The only bad faith might be using warrant canaries knowing that they may still be able to be compelled legally to comply.

"The question at hand here is whether the government can compel you to keep the canary in place after a search/siezure." I personally (which is the only viewpoint that matters here) would consider falsely updating the canary to be acting in bad faith. I would consider it to be morally negative. I consider it to be of the same kind as the other examples I gave of acting in bad faith. YMMV.

> falsely updating the canary to be acting in bad faith. I would consider it to be morally negative. I consider it to be of the same kind as the other examples I gave of acting in bad faith.

Except that in the case of the canary, there might be the very real threat of violence or jail time for you or your loved ones.

If it were me, I can see a world where I would do things I think are morally negative if it keeps me and my loves ones alive and out of jail, and I think many other people are the same.

Re: Cloudflare expands its government warrant canaries

#118

Post by gonehome »

djakjxnanjak wrote: post #76
goto11 wrote: post #50

Earlier quoted context omitted.

Developers often thinks laws work just like computers: If you can find a loophole where you technically follow the letter of the law, while undermining its intent, then you have hacked the law and can't be punished! Judges do not think like that though. Remember when Microsoft was forced by a judge to offer a version of Windows without the Internet Explorer browser? Microsoft just removed all the dll's IE used. But s…

Often, the law does treat action and inaction very differently. Eg: it’s illegal to poison your ailing grandparent, but legal to let them die by removing the feeding tube (because you are just “not feeding them anymore”).

Intent and spirit of the law matter more than the difference between action and inaction.

Re: Cloudflare expands its government warrant canaries

#119

Post by kernelPan1c »

fivre wrote: post #107
kernelPan1c wrote: post #105

> "has never turned over their SSL keys or customers’ SSL keys to anyone;" How would they be able to give up customers' SSL keys?

Customers on some plan can upload a certificate of their choice, and generally have to provide the key along with it. Keyless SSL exists, but isn't widespread.

Ah, I guess the point I'm missing is that with a 'serverless' setup, the cloud provider must have access to your private key? Unless you use some sort of key server setup (what they call Keyless SSL)

Re: Cloudflare expands its government warrant canaries

#120

Post by bhelkey »

jcrites wrote: post #61
jakejarvis wrote: post #48

Earlier quoted context omitted.

Glad you guys included this part: > "Although signing the declaration makes it impossible for a third party to produce arbitrary declarations, it does not prevent them from using force to coerce rsync.net to produce false declarations." That's always been a question in the back of my mind when seeing all these canaries. Anyone know if ordering a company to do this is feasible under US law, either by force or by autho…

The EFF has a FAQ about warrant canaries which addresses some of these topics: https://www.eff.org/deeplinks/2014/04/warrant-canary-faq It is believed to be unlikely that a court would compel a company's false speech to maintain a warrant canary. > Have courts upheld compelled speech? > Rarely. In a few instances, the courts have upheld compelled speech in the commercial context, where the government shows that the c…

If the warrant canaries were updated automatically, could a court compel a company to not change the script?
Post reply on HN